Microsoft’s October 2026 Patch Tuesday fixes 1,413 Microsoft CVEs. That is a new record, set only one month after September’s previous high of 974, and it represents a jump of roughly 45%.
The release covers Windows, Microsoft 365 and Office, SharePoint Server, SQL Server, Exchange Server, Azure, Defender and developer tools. It also republishes one non-Microsoft CVE. Two of the fixes are zero-days: one is under active exploitation and the other has been publicly disclosed.
Severity Breakdown for October 2026 Patch Tuesday
Of the 1,408 CVEs with severity ratings, 78 are Critical, 1,329 are Important and one is Moderate. All 1,408 require customers to install an update. Sixty-five of the Critical flaws allow remote code execution (RCE). The other 13 involve elevation of privilege or spoofing.
Elevation of privilege leads with 673 CVEs. It is followed by remote code execution (315), information disclosure (252), denial of service (72), security feature bypass (40), tampering (29) and spoofing (27). The first two types make up about 70% of the release. That combination is dangerous because RCE gives an attacker initial access and privilege escalation turns that access into full control.
Windows accounts for 1,102 vulnerabilities across 39 updates. The rest break down as follows: Office (134 vulnerabilities, 11 updates), developer tools (61, 60), SharePoint Server (36, 1), other products (32, 25), SQL Server (22, 8), Azure (15, 20), Exchange Server (7, 8), Defender (4, 3) and Edge (0, 1).
Together that comes to 1,414 vulnerabilities and 176 updates. Microsoft’s own figures don’t fully match. The release notes cite 1,413, the product breakdown totals 1,414 and the published CVE list contains 1,411. This article uses the release-notes figure.
Two Zero-Days, Both Rated Important
CVE-2026-96951 is a security feature bypass in Windows Shell, and attackers are actively exploiting it. It defeats Mark of the Web, which means malicious files arriving by email or chat can open without the usual warnings. Users still have to open the file, so the flaw works well alongside phishing. It should be patched on every Windows endpoint first.
CVE-2026-108398 affects the .NET Framework. It has been publicly disclosed but has not been exploited. It could let an authenticated attacker bypass Windows Defender Application Control and run code inside a protected process. That makes it a concern for organizations that rely on allowlisting to contain intruders.
Both flaws are rated only Important, which shows that exploit status should matter more than severity labels. Neither appeared in CISA’s Known Exploited Vulnerabilities catalog at publication, although additions often follow within days.
Critical Flaws in Network, Identity and SharePoint Server
Windows DHCP Server has five Critical RCE flaws: CVE-2026-96934, CVE-2026-88117, CVE-2026-88120, CVE-2026-88119 and CVE-2026-88171. The DHCP Client has one more (CVE-2026-70250). Several other network services also carry Critical RCEs: Microsoft QUIC (CVE-2026-105016, CVE-2026-100219), Remote Desktop Gateway (CVE-2026-70187), Message Queuing (CVE-2026-108460, CVE-2026-100202) and RMCAST (CVE-2026-69789). Systems reachable from outside the network should be patched early.
Identity services are affected too. Active Directory Domain Services (CVE-2026-70229) and NDES (CVE-2026-69802) have RCE flaws, and AD FS has two spoofing bugs (CVE-2026-108131, CVE-2026-96222). Exchange Server (CVE-2026-70571) and Windows Deployment Services (CVE-2026-88174) each have a Critical RCE. SharePoint Server has a Critical elevation-of-privilege flaw (CVE-2026-102866).
Hyper-V receives fixes for host-level RCE (CVE-2026-102214, CVE-2026-105733), which could put every guest VM at risk, and for privilege escalation (CVE-2026-108399). VBS Enclave has five Critical elevation-of-privilege flaws: CVE-2026-108471, CVE-2026-108130, CVE-2026-102211, CVE-2026-96914 and CVE-2026-88074. Four more affect the Windows Kernel, Graphics Kernel, ALPC and the WSL Linux kernel (CVE-2026-96913, CVE-2026-88073, CVE-2026-83917, CVE-2026-62840), and these could give an attacker SYSTEM or root access.
Office apps account for 34 Critical RCEs: 19 in Excel, 5 in Outlook, 4 in PowerPoint, 3 in Word and 3 in Visio. The Mark of the Web bypass makes these more dangerous. Another ten affect media and rendering components, including Media Foundation, GDI+, Codecs, Windows PDF, Text Shaping and Raw Image Extension (CVE-2026-96202, CVE-2026-96943). They can be triggered just by opening a crafted file, with no macros involved. The PostScript Printer Driver, which is often overlooked, has three more (CVE-2026-70153, CVE-2026-70147, CVE-2026-108467).
